Prompt injection explained, with video, slides, and a transcript
The foundational explainer that makes the attack click in 15 minutes.
Open simonw.substack.com →
Building & Product
Video
Video
Article
Article
Article
Article
Guide
Article
Article
Article
Article
Article
Article
Article
Article
Tool
What can go wrong when an agent acts on my behalf, and how do I keep it safe?
The core risk is Simon Willison's lethal trifecta: an agent that can read your private data, sees untrusted content (any email or web page), and can communicate externally can be tricked by a poisoned message into leaking or destroying things, with no bug in your code required. Prompt injection remains unsolved, so design around it: give agents the minimum access needed, never combine all three capabilities in one agent, require human approval for anything that sends, spends or deletes, and log everything.
Go deeper
16 resources.
Simon Willison on Industry's Tardy Response to Prompt Injection
Why the industry still has no robust fix, straight from the source.
Watch on YouTube youtube.com →The lethal trifecta for AI agents
The single most important security idea for anyone deploying agents.
Open simonwillison.net →The lethal trifecta (newsletter edition)
The same argument in shareable form for your team channel.
Open simonw.substack.com →Prompt injection series
The full running history of the attack class, from the person who named it.
Open simonwillison.net →Prompt injections as far as the eye can see
Fresh real-world exploits showing this is not theoretical.
Open simonw.substack.com →AI Agent Security Cheat Sheet
The industry-standard checklist, free and framework-agnostic.
Open cheatsheetseries.owasp.org →OWASP Top 10 for Agentic Applications: Key Takeaways
Translates the OWASP list into concrete actions for small teams.
Open goteleport.com →How the Lethal Trifecta Exposes Agentic AI
Security researchers show working attacks and layered defenses.
Open hiddenlayer.com →Understanding the Lethal Trifecta of AI Agents
Frames the fix as an authorization problem, which is what it is.
Open osohq.com →The agentic AI lethal trifecta: what CISOs should know
The enterprise-buyer view, useful when their security team reviews your agent.
Open techtarget.com →Why AI Agents Require Architectural Boundaries
Argues you cannot prompt your way to safety; the architecture must enforce it.
Open cyera.com →Building AI agents the safe way
A calm engineering-management view of guardrails and human-in-the-loop.
Open infoworld.com →Addressing the OWASP Top 10 Risks in Agentic AI
How a major platform maps each OWASP risk to concrete mitigations.
Open microsoft.com →AI Security in 2026: Prompt Injection, the Lethal Trifecta, and How to Defend
A current-year synthesis tying the main threats to a defense stack.
Open airia.com →Lethal trifecta threat model (agentic patterns repo)
A copyable taint-tracking and approval-gating pattern for your own build.
Open github.com →More in AI Agents
- What actually is an AI agent, in plain language? 18 →
- Why would a founder use agents instead of a chatbot or automation? 18 →
- What real tasks are founders delegating to agents today? 20 →
- How do I build my first agent without being technical? 20 →
- Which platform or framework should I build my agents on? 18 →
- How much do AI agents cost to run, and how do I keep the bill under control? 18 →
- How do I test an AI agent and know when it's reliable enough to trust? 18 →
- What is MCP, and why does it matter for my agents? 18 →
- Should I build one agent or a team of agents working together? 18 →
- Can coding agents like Claude Code actually build my product? 18 →
- Is there a real startup opportunity in building vertical AI agents? 19 →
- How should I price a product built on AI agents? 18 →
- Why do most AI agent projects fail, and what do the winners do differently? 19 →
- How do I give my agent the right context and memory so it stops forgetting? 18 →
Also in Starting Up
The same ground, over in Build the product, our Starting Up track.
eChai Partner Brands
